Leantime: project management built around goals for people who dislike project management

Strategy, planning and execution in one install

Leantime describes itself as a goals focused project management system for non-project managers, built with ADHD, dyslexia and autism in mind. The positioning matters because it explains the product shape: instead of starting from a backlog, it starts from strategy canvases and works down.

The feature table is organised into four columns. Task management covers kanban boards, gantt, table, list and calendar views, unlimited subtasks and dependencies, milestones, sprint management, and time tracking with timesheets. Project planning covers project dashboards with reports and status updates, goal and metrics tracking, a Lean and Business Model Canvas, a SWOT canvas, and risk analysis. The knowledge column has wikis and docs, idea boards, retrospectives, file storage through S3 or the local filesystem, screen and webcam recording, and comments on everything. Administration covers installation, roles with per-project permissions, two factor authentication, LDAP and OIDC, plugins and an API, chat integrations with Slack, Mattermost and Discord, and translations in more than twenty languages.

The table ends with a footnote that reads like an answer to the most common first question about self hosted tools: all of these features are included in the OSS version.

The requirements list is long and worth reading twice

Before any of that runs, there is a system requirements section that does not soften anything. PHP 8.2 or newer. MySQL 8.0 or newer, or MariaDB 10.6 or newer. Apache or Nginx, with IIS described as working with some modifications.

Then the PHP extensions, which is the part that catches people out: BC Math, Ctype, cURL, DOM, Exif, Fileinfo, Filter, GD, Hash, LDAP, Multibyte String, MySQL, OPcache, OpenSSL, PCNTL, PCRE, PDO, Phar, Session, Tokenizer, Zip and SimpleXML. LDAP being mandatory is worth noting, because it means an image without the extension will fail rather than degrade, even if you never intend to use directory integration.

The production install path is a zip rather than a package manager pull. The README asks you to download the release package named `Leantime-vx.x.x.zip`, create an empty MySQL database, upload the whole directory to the server, point the domain root at `public/`, and rename `config/sample.env` to `config/.env`. A Docker image is offered as the supported alternative. The point of pointing the document root at `public/` is that the tree keeps `app/`, `config/`, `storage/` and `userfiles/` outside the web root, so the release archive is a directory you deploy rather than a single script.

Release notes that read like a changelog with an audit trail

Three tagged releases sit close together in early July 2026, and their notes are unusually specific about issue numbers, which makes them useful for deciding whether a version is safe to run.

v3.9.6 is the one to look at first. It is a security release covering authorization, SSRF, reset token, LDAP and stored XSS issues, plus tighter permission checks on plugin management and stricter validation of install input. It also encodes user IDs in avatar image sources to prevent DOM-based XSS, and strips credentials from getUser API responses. If you are running anything older, that release is the reason to upgrade.

v3.9.7 is the feature release. It adds cross-project program views, so task views can span multiple projects with sprints inherited across the program board, and it raises the default API rate limit from 10 to 120 requests per minute. v3.9.8 is a fix release on top, addressing milestones showing zero percent completion, a milestone modal losing focus, closed projects keeping to-dos browsable, and a file browser memory issue.

One detail in v3.9.8 connects the release notes back to the requirements list: sessions are isolated into their own Redis database to avoid clashes with other cached data. Redis is not mentioned in the system requirements, so a deployment that took the README at face value may need to add it.

A PHP application with a JavaScript build pipeline attached

The `package.json` describes the front end rather than the application, and it is where the editor and calendar choices become visible. The rich text layer is a large set of `@tiptap/extension-*` packages covering tables, task lists, mentions, highlights, subscripts, superscripts and typography. The calendar side is `@fullcalendar/google-calendar` plus `@fullcalendar/icalendar` and `@fullcalendar/luxon3`, which is a reasonable set for a tool whose calendar view has to line up with Google Calendar and with iCalendar feeds.

Error reporting is wired through `@sentry/browser` and `@sentry/webpack-plugin`. Animation assets come from `@lottiefiles/*`, and icon picking from a Font Awesome icon picker package. The scripts section is short: a build through `rollup -c --bundleConfigAsCjs`, plus demo, test and update scripts that run through `node`.

The repository tree shows the PHP side more clearly. There is `app/`, `bootstrap/`, `config/`, `database/`, `storage/`, `types/`, `tests/`, a `makefile` at the root, `nginx.example.conf` and `nginx-subfolder.example.conf` for deployments that cannot use the document root directly, and a `helm/` directory for Kubernetes installs. Static analysis is set up rather than aspirational: `phpstan.neon`, `phpcs.xml`, `.phpstan/`, `.pint/`, and `codeception.yml` for tests.

Where the tooling points beyond the PHP core

Two entries in the recent release notes point at a direction the feature table does not mention. v3.9.6 added shared AI and MCP support classes along with personal access token management, and a generic content templates domain. v3.9.7 reorganised the MCP tool classes into their domain modules and then, in the same release, repaired runtime bugs in those domain tools that turned up during live end to end testing.

v3.9.8 adds the detail that makes the MCP story usable: the `/mcp` endpoint now accepts Leantime API keys, and a shim for a removed `php-mcp` provider lets in-place upgrades boot at all. There is a McpServer submodule being bumped separately, which the release notes attribute to a bulk add tasks fix. This is what an agent-readable interface looks like when it is added to an application that was not designed for one, and it is worth watching rather than assuming.

The practical reading is that Leantime is a mature PHP application that has recently grown an interface for tooling. The 337 open issues on the repository are the other half of that picture: a large user base, an active release line, and a backlog that a small team is working through.

What to check before you deploy it

The README is a good installation document and a thin operational one. It tells you the requirements, gives you the zip and Docker paths, and shows the screens. What it does not do is tell you how to back the database up, how to run migrations against an existing install, or what to do about the Redis dependency that a recent release introduced.

Those gaps are normal for a project at this scale, and the surrounding structure suggests where the answers live. There is a `CHANGELOG.md` and a `SECURITY.md` at the root, a `.github/` directory with release note configuration, a `blocklist.json` with a `generateBlocklist.mjs` script beside it, and a `CLAUDE.md` that suggests the project has been developed with AI assistance in the loop.

The version to pin is easy to work out. The latest release is v3.9.8 and `package.json` carries the same version, 3.9.8, so the front end and the release line are aligned. The repository is under the AGPL-3.0, has 11,624 stars and 1,130 forks, and the last push was on 2026-09-07, so the line is moving.

Editorial conclusion

Leantime is a wide project management application rather than a focused one, and the honest way to read it is as a single install that covers the whole arc from a business model canvas down to a personal timesheet. The feature table is unusually clear that all of it ships in the open source edition, the requirements list is explicit down to individual PHP extensions, and the release notes show the pace of work, with three tagged releases in early July 2026 covering a security hardening pass, an API rate limit increase and MCP tooling. Start from the system requirements list, since the PHP extension set is long, then read the release notes for the version you plan to run.

Frequently asked questions

Official sources

1. Leantime/leantime on GitHub
2. License: AGPL-3.0
3. Project website
4. README
5. Releases